Drupalgeddon 2: Profiting from Mass Exploitation
Summary: A patch for a critical Drupal remote code execution vulnerability, CVE-2018-7600, was released on March 28, 2018, and after public exploit code appeared on April 13, 2018, Volexity observed thousands of scan and exploitation attempts against unpatched Drupal 7 and 8 sites. The most widespread payload downloaded and executed a script that installed the XMRig cryptocurrency miner, tied to a Monero wallet that had earned 70.4 XMR (about $13,400) on monerohash.com and 544.74 XMR (about $105,566.80) on monero.crypto-pool.fr before that pool suspended it.
What's compelling: Volexity ties this scanning to an actor it previously saw loading XMRig on Oracle WebLogic servers via CVE-2017-10271, and says any Drupal instance unpatched before April 13, 2018 was very likely compromised several times over - with one wallet alone having mined over $105,000 in Monero.